Use the __sentinel attribute.

Start using the gcc sentinel attribute, which can be used to
mark varargs function that need a NULL pointer to mark argument
termination, like execl(3).

Relnotes: yes